2026-07-10 13:01:01 +00:00
1 changed files with 29 additions and 1 deletions
@@ -17,11 +17,23 @@ spec:
      labels:
        app.kubernetes.io/name: shelly-manager
      annotations:
-        # Multus attaches `net1` on v30iot with a static IP (see
+        # Multus attaches `net1` on v30iot with a DHCP-leased address (see
        # shelly-manager-network-attachment.yaml). The mDNS resolver
        # inside the app needs L2 presence on the IoT VLAN to browse
        # for `_shelly._tcp.local.` — multicast doesn't cross the L3
        # boundary between the cluster pod CIDR and v30iot.
+        #
+        # But net1 must carry ONLY multicast, not the admin HTTP server.
+        # The app has no auth of its own; its ingress is gated by Authentik
+        # (shelly-manager-gate). That gate only guards the Traefik path —
+        # macvlan traffic bypasses Cilium policy entirely, so a `0.0.0.0`
+        # bind exposes the unauthenticated UI on :8080 directly to every
+        # device on the IoT VLAN (verified 2026-07-10: GET http://<net1
+        # ip>:8080/ from the VLAN returned 200 and the full UI). See the
+        # ASPNETCORE_URLS binding below, which pins Kestrel to the pod
+        # (eth0) address so :8080 is not reachable over net1. The mDNS
+        # resolver is a separate ZeroconfResolver socket set and is
+        # unaffected.
        k8s.v1.cni.cncf.io/networks: shelly-manager-iot
    spec:
      # eth0 (Cilium-managed pod network) is still the primary — it
@@ -44,6 +56,22 @@ spec:
          env:
            - name: TZ
              value: Europe/Berlin
+            # Pin Kestrel to the pod's eth0 (cluster CIDR) address, not
+            # 0.0.0.0. The image's Dockerfile default is
+            # ASPNETCORE_URLS=http://0.0.0.0:8080, which also binds the
+            # macvlan net1 interface on the IoT VLAN — exposing the
+            # unauthenticated UI to that untrusted segment past the
+            # Authentik gate. POD_IP is the eth0 IPv4 (status.podIP); the
+            # Service, the Authentik outpost, and the kubelet httpGet
+            # probes all reach the app on that address. mDNS discovery is
+            # unaffected: ZeroconfResolver binds its own multicast sockets
+            # on net1 independently of Kestrel.
+            - name: POD_IP
+              valueFrom:
+                fieldRef:
+                  fieldPath: status.podIP
+            - name: ASPNETCORE_URLS
+              value: "http://$(POD_IP):8080"
          volumeMounts:
            - name: data
              mountPath: /data